Abstract: Techniques for evaluating and improving data security are provided. In one embodiment, a method includes receiving results from a sensitive data scan of information technology (IT) infrastructure of an organization, in which the result includes indications of a volume of sensitive data found during the scan, types of the sensitive data found during the scan, and locations at which the sensitive data was found during the scan. The method also includes determining a cybersecurity risk score for the IT infrastructure. This can include calculating the cybersecurity risk score based on the volume of sensitive data found during the scan, value of the sensitive data found during the scan, and vulnerability of the locations at which the sensitive data was found during the scan. Additional systems, devices, and methods are also disclosed.

Abstract: Techniques for finding and associating personal identifying information with an individual. In one embodiment, a method includes searching a database of personal identifying information held by an organization for instances of a particular item of personal identifying information of a data subject. The database may link personal identifying information to locations at which that personal identifying information is held by the organization. After a storage location with a found instance of the particular item of personal identifying information of the data subject is determined, additional personal identifying information of potential relevance to the data subject may be found at the storage location and used for further searching of the database for more personal identifying information of potential relevance to the data subject at other locations. Personal identifying information may be associated with the data subject and included in a data subject profile.